[
https://issues.apache.org/jira/browse/CAMEL-24438?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107245#comment-18107245
]
Andrea Cosentino commented on CAMEL-24438:
------------------------------------------
Two robustness gaps hit while writing the test for this, both pre-existing and
separate from the confinement question. Recording them here rather than filing
separately, since they live in the same method.
*1. {{staticEnabled=true}} with {{port=0}} throws NPE at startup.*
{{doStart()}} looks the router up by a name derived from the *configured* port:
{code:java}
String routerName = VertxPlatformHttpRouter.getRouterNameFromPort(getPort());
router = VertxPlatformHttpRouter.lookup(camelContext, routerName);
{code}
With {{setPort(0)}} - the "pick an ephemeral port" convention, and what
{{MainHttpServerRouteTest}} uses - the lookup returns null, and
{{setupStatic()}} then dereferences it:
{noformat}
java.lang.NullPointerException: Cannot invoke
"VertxPlatformHttpRouter.route(String)" because "this.router" is null
at MainHttpServer.setupStatic(MainHttpServer.java:239)
at MainHttpServer.setupConsoles(MainHttpServer.java:230)
at MainHttpServer.doStart(MainHttpServer.java:224)
{noformat}
{{MainHttpServerRouteTest}} does not hit it only because it leaves static
disabled, so the null router is never dereferenced.
*2. A directly constructed {{MainHttpServer}} has no {{staticContextPath}}
default.*
The {{"/"}} default lives on {{HttpServerConfigurationProperties}}, not on
{{MainHttpServer}}, so {{setStaticEnabled(true)}} without also setting the
context path throws:
{noformat}
java.lang.NullPointerException: Cannot invoke "String.endsWith(String)" because
"path" is null
at MainHttpServer.setupStatic(MainHttpServer.java:236)
{noformat}
Both are reachable only through direct programmatic use, since
{{DefaultMainHttpServerFactory}} always copies the configuration defaults
across - which is why neither has been noticed. Worth a null check on the
router and a {{"/"}} default on the field.
_Claude Code on behalf of oscerd_
> camel-platform-http-main - static file serving resolves against the process
> working directory and the classpath root
> --------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24438
> URL: https://issues.apache.org/jira/browse/CAMEL-24438
> Project: Camel
> Issue Type: Bug
> Components: camel-platform-http
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{MainHttpServer.setupStatic()}} mounts a catch-all route at
> {{staticContextPath}} + {{"*"}} (default {{"/"}}) and resolves the requested
> path like this:
> {code:java}
> String u = ctx.normalizedPath();
> ...
> File f = new File(u);
> if (!f.exists() && staticSourceDir != null) {
> f = new File(staticSourceDir, u);
> }
> if (f.exists()) {
> is = new FileInputStream(f);
> } else {
> is = camelContext.getClassResolver().loadResourceAsStream(u);
> if (is == null) {
> is =
> camelContext.getClassResolver().loadResourceAsStream("META-INF/resources/" +
> u);
> }
> ...
> }
> {code}
> {{new File(u)}} resolves relative to the process working directory, and it is
> tried *first*. {{staticSourceDir}} is only consulted when that misses, so it
> behaves as a fallback location rather than as a root the lookup is confined
> to. The classpath root is then tried as well. There is no extension allowlist
> and no denylist.
> camel-main and camel-jbang deployments conventionally keep
> {{application.properties}} in the working directory, and the route is
> registered at {{order(Integer.MAX_VALUE)}} so it answers anything no consumer
> matched. Vert.x path normalization does prevent {{../}} escapes, but the
> working directory and the classpath are already the roots being served.
> Proposal: make {{staticSourceDir}} an actual root - resolve every request
> under it and reject anything that escapes - and confine the classpath lookup
> to a dedicated prefix such as {{META-INF/resources/}} instead of the
> classpath root. Needs an upgrade-guide entry, since deployments relying on
> working-directory resolution would have to set {{staticSourceDir}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
